Add PostgreSQL reporting schema and ingest contract

docs/ocsentinel-n8n-contract.md

@@ -26,6 +26,36 @@ n8n is responsible for:
 - organization-wide aggregation
 - NinjaOne organization API updates
 
+## Required n8n Workflow
+
+The webhook itself may be reachable only on the internal network. It does not
+require public access to the n8n editor or API. Every managed device must be
+able to reach the webhook URL over HTTPS.
+
+1. `Webhook`: accept `POST` on the configured private URL.
+2. `Code`: reject a request if `X-ATN-Device`, `X-ATN-Timestamp`,
+   `X-ATN-Nonce`, `X-ATN-Version`, `X-ATN-Payload-SHA256`, or
+   `X-ATN-Signature` is missing; reject timestamps outside five minutes.
+3. `Code`: calculate SHA-256 over the raw request body and compare it with
+   `X-ATN-Payload-SHA256`. Calculate HMAC-SHA256 over the following exact
+   newline-separated string and compare it in constant time with
+   `X-ATN-Signature`:
+
+```text
+<device>\n<timestamp>\n<nonce>\n<version>\n<payload-sha256>
+```
+
+4. `Postgres`: insert the nonce into `ocsentinel.ingest_nonce` with a short
+   expiry. If it already exists, return `409` and do not process the report.
+5. `Postgres`: upsert the device, insert a row in `ocsentinel.scan_report`,
+   then return `202`.
+6. A separate scheduled n8n workflow reads
+   `ocsentinel.organization_summary` and `ocsentinel.current_device_status`
+   to update the NinjaOne organization fields through the API.
+
+Use an n8n credential for the shared HMAC secret and a separate n8n credential
+for PostgreSQL. Do not store either value in workflow JSON or this repository.
+
 ## PostgreSQL Scope
 
 - The client only knows its outward upload destination.